24

I want to display banner (welcome message) for SSH users with a specific welcome message for each user.

2 Answers 2

48

You did not specify, what SSH server are you using. I'm assuming OpenSSH.

Note that the SSH banner and the MOTD are two different things.

While almost indistinguishable in an SSH terminal, they have a different behavior, for example, in an SFTP client.


The MOTD is just a text printed on an interactive terminal. So, it won't (and cannot) be sent to SFTP clients, for example (more about that later).

The MOTD is hard-coded to the /etc/motd in OpenSSH. You can turn it on/off globally only, using the PrintMotd directive.

On some Linux systems, however, the PrintMotd is always off and the MOTD is printed by the PAM stack instead (using the pam_motd module). In this case you can turn it off via the /etc/pam.d/sshd or specify a custom motd= path as a module parameter.


The SSH banner is a special SSH 2.0 feature, sent in a specific SSH packet (SSH2_MSG_USERAUTH_BANNER).

As such, even non-terminal clients, like SFTP clients, can process it and display to user. See how the banner displays in WinSCP SFTP/SCP client for example.

The SSH banner is configurable per user (or group or other criteria) in the sshd_config using the Banner and the Match directives:

Match User username1
    Banner /etc/banner_user1

Match User username2
    Banner /etc/banner_user2

See also Disable ssh banner for specific users or ips.


Of course, you can also use a custom implementation for the message/banner. Simply print a message selected using your custom logic from a global profile script.

As with the MOTD, this won't work for non-interactive sessions (the SFTP and alike).

More importantly, not only it won't work, you need to make sure that you print the message for an interactive terminal only. What OpenSSH does automatically for the /etc/motd. Either use a global profile script that executes for an interactive terminal only, or print the message conditionally based on value of the TERM environment variable.

If you print the message for non-interactive session, you break any client that uses a strict protocol, such as the SFTP or the SCP, as the client will try to interpret your text message as a protocol message, failing badly.

See for example description of such issue in documentation of WinSCP SFTP/SCP client.

(I'm the author of WinSCP)

7
  • Hi all thanks for reply, I got the solution please correct me if i am wrong. I append this lines into /etc/profile file. PGROUP=groups|awk '{print $1}' cat /etc/motd.${PGROUP} before adding this line i create banner file for each user under /etc directory. and file like motd.root and motd.alex and this work for me.
    – user260277
    Dec 18, 2014 at 9:04
  • That should do too. Except as per my answer, this works in an interactive terminal only. It won't work for SFTP and similar. Dec 18, 2014 at 9:20
  • interactive terminal means ?
    – user260277
    Dec 18, 2014 at 9:23
  • It's a terminal that a human interacts with (as opposite to SFTP session, SCP session or non-interactive terminal used for remote execution of some batch task) Dec 18, 2014 at 10:07
  • I have included some tricky details about custom implementation of the banner. Dec 18, 2014 at 13:02
12

You can use "$HOME/.ssh/rc" file too for archive what you want to do

echo "echo Hello World" > /home/pluto/.ssh/rc
ssh pluto@localhost
Last login: Thu Dec 18 08:46:16 2014 from localhost.localdomain
Hello World

So, you can have one ssh rc for every user.

6
  • hi, I try this but it gives error message .ssh/rc: 1: .ssh/rc: welcom: not found.
    – user260277
    Dec 18, 2014 at 9:17
  • was my fault, i did a typo, you need echo like in normal bash script
    – c4f4t0r
    Dec 18, 2014 at 9:26
  • "Wolrd" is also a typo :)
    – simon
    Dec 18, 2014 at 16:15
  • I get "stty: standard input: Inappropriate ioctl for device". Dec 18, 2014 at 19:00
  • 1
    "The shell script /etc/sshrc is invoked by the SSH server for each incoming SSH connection. [...] You may define a similar script in your account, ~/.ssh/rc (SSH1, OpenSSH) or ~/.ssh2/rc (SSH2), to be invoked for every SSH connection to your account. If this file exists, /etc/sshrc isn't run. The SSH rc file is much like a shell startup file (e.g., ~/.profile or ~/.cshrc), but it executes only when your account is accessed by SSH. It is run for both interactive logins and remote commands." From O'REILLY - SSH: The Secure Shell
    – domsson
    Jun 27, 2022 at 3:04

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .